CVE-2026-46860: Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)

Synopsis

A critical unauthenticated remote code execution vulnerability affects MySQL Router versions 9.0.0 through 9.7.0 in the Router General component. An attacker with network access over HTTP requires no credentials and no victim interaction to exploit this flaw. Successful exploitation results in full takeover of the MySQL Router instance, giving the attacker complete control over confidentiality, integrity, and availability. No upstream fix has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the MySQL Router HTTP interface over the network; no physical or local access is required.

• AuthenticationNot required

  No credentials of any privilege level are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• A successful attacker gains full read access to all data handled by MySQL Router, including proxied credentials, query content, and connection metadata.
• The attacker can modify or inject data in transit between clients and backend MySQL instances, corrupting or tampering with persisted database rows.
• The attacker can crash or take over the MySQL Router process, denying database connectivity to all applications routed through it.
• Because Router sits in the path of all backend database traffic, a takeover can serve as a pivot point for lateral movement toward upstream MySQL servers.